798ca7fed4
We used to store MinimorphicPropertyAccessInfo indexed on the feedback slot id. This works fine when there is no inlining but returns the wrong access information when functions are inlined. Index it based on FeedbackSource to avoid these problems. Bug: v8:10582,chromium:1125871 Change-Id: Id01010f3153f7e21495d73899a8604a64417ae95 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2401426 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#69845}
26 lines
620 B
JavaScript
26 lines
620 B
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --dynamic-map-checks --opt --no-always-opt
|
|
|
|
function bar(obj) {
|
|
// Add two dummy loads to make sure obj.b is in the same slot index as obj.a
|
|
// in foo.
|
|
obj.y;
|
|
obj.x;
|
|
return obj.b
|
|
}
|
|
|
|
function foo(obj) {
|
|
bar(obj);
|
|
return obj.a;
|
|
}
|
|
|
|
var obj = { a: 10, b: 20};
|
|
%PrepareFunctionForOptimization(foo);
|
|
%EnsureFeedbackVectorForFunction(bar);
|
|
foo(obj);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertEquals(10, foo(obj));
|